Re: [PATCH v2 00/10] OvmfPkg: add Crypto Driver support

["Gerd Hoffmann" <kraxel@redhat.com>]

On Fri, Feb 10, 2023 at 02:46:34PM +0100, Ard Biesheuvel wrote:
> On Fri, 10 Feb 2023 at 14:42, Ard Biesheuvel <ardb@kernel.org> wrote:
> >
> > > Can LTO be enabled for the NOOPT build?  Or depends that on
> > > optimizations being turned on?

Turns out: kind of.  The crypto driver effectively does

	if (fixed.pcd.bit)
		call libcrypt / libopenssl
	else
		throw error

With optimizations turned off altogether gcc will not notice it can
evaluate the PCD config bits at compile time, which in turn leads to
everything being compiled in no matter whenever the features are
enabled or not ...

take care,
  Gerd

>From e0a080ead544813445f731eef137747ff805a5cd Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Mon, 13 Feb 2023 10:21:50 +0100
Subject: [PATCH 1/1] CryptoPkg/Driver: enable moderate optimizations for NOOPT
 builds

With optimizations turned off altogether gcc will not evaluate the
(constant) configuration PCDs at compile time (see CALL_BASECRYPTLIB
macro).  Which renders LTO ineffective and leads to huge amounts of
dead code being included in the crypto driver builds.

Turn on optimizations for GCC, lowest level (-O1), to fix this.

FIXME: visual studio needs that too.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 CryptoPkg/Driver/CryptoDxe.inf | 3 +++
 CryptoPkg/Driver/CryptoPei.inf | 3 +++
 CryptoPkg/Driver/CryptoSmm.inf | 3 +++
 3 files changed, 9 insertions(+)

diff --git a/CryptoPkg/Driver/CryptoDxe.inf b/CryptoPkg/Driver/CryptoDxe.inf
index 0d08f3a190c8..44921c1fdaa8 100644
--- a/CryptoPkg/Driver/CryptoDxe.inf
+++ b/CryptoPkg/Driver/CryptoDxe.inf
@@ -47,3 +47,6 @@ [Pcd]
 
 [Depex]
   TRUE
+
+[BuildOptions]
+  GCC:NOOPT_*_*_CC_FLAGS = -O1
diff --git a/CryptoPkg/Driver/CryptoPei.inf b/CryptoPkg/Driver/CryptoPei.inf
index dfa1ab58b16f..45704f5f9e42 100644
--- a/CryptoPkg/Driver/CryptoPei.inf
+++ b/CryptoPkg/Driver/CryptoPei.inf
@@ -49,3 +49,6 @@ [Pcd]
 
 [Depex]
   TRUE
+
+[BuildOptions]
+  GCC:NOOPT_*_*_CC_FLAGS = -O1
diff --git a/CryptoPkg/Driver/CryptoSmm.inf b/CryptoPkg/Driver/CryptoSmm.inf
index 9fe8718823d2..906cf06006f4 100644
--- a/CryptoPkg/Driver/CryptoSmm.inf
+++ b/CryptoPkg/Driver/CryptoSmm.inf
@@ -47,3 +47,6 @@ [Pcd]
 
 [Depex]
   TRUE
+
+[BuildOptions]
+  GCC:NOOPT_*_*_CC_FLAGS = -O1
-- 
2.39.1